Does the Prompt Firewall run locally?

Yes. The firewall operates as a local HTTP/HTTPS proxy on your machine, ensuring prompts are intercepted and sanitized before they reach the external network.

Is a local LLM necessary for the Prompt Firewall?

No. The firewall scans supported text requests with deterministic rules even when no local LLM is configured. A local LLM is optional and adds context-aware review. Only traffic routed through the proxy can be inspected.

Which clients can use the Prompt Firewall?

Any AI client or tooling that can be configured to use an HTTP/HTTPS proxy, including Claude Code, GPT / Codex, and OpenAI SDK applications. Traffic must be configured to use the local proxy.

How does it protect PII?

It uses regex and pattern-based deterministic filtering to detect and redact standard sensitive strings like API keys, social security numbers, and internal IP addresses before the payload is allowed out.

docs/tools/prompt_firewall

AgenticSecurity

Prompt Firewall & Sanitizer Proxy

Tool Name: prompt_firewall

The Prompt Firewall intercepts outbound AI agent prompts, preventing confidential data and secrets from leaving your machine. Acting as a proxy for configured clients like Claude Code and GPT / Codex, it uses deterministic PII data filters and offers optional local LLM integration for complex prompt scanning and optimization.

Quick setup

Two commands. About 20 seconds.

Free · open source

Install AgenticStore once, launch the local webapp, and open Relay from your browser. No account or separate Relay download is required.

macOS and Linux

bash

pip install --upgrade agentic-store-mcp
agentic-store-webapp

Windows PowerShell

powershell

py -m pip install --upgrade agentic-store-mcp
agentic-store-webapp

Then open http://localhost:8765 and select Relay. For MCP clients, run agentic-store-mcp or follow the client setup guide.

Agentic Store Architecture with Prompt Firewall

Agentic Store Architecture — Data stays protected before reaching third-party APIs.

Demo: The Prompt Firewall in action.

Features & Capabilities

Deterministic PII Filters: Uses rules-based pattern matching to instantly identify and redact highly sensitive data such as keys, tokens, and standard PII.
Local LLM Scanning: Wire the proxy to an optional local inference engine (like Ollama or llama.cpp) to contextually inspect and optimize unstructured prompt content for maximum privacy.
Universal Compatibility: Works entirely outside the core AI agent logic by acting as a native HTTP/HTTPS proxy. Out-of-the-box support for any standard AI HTTP client, including Claude Code.

GPT / Codex and OpenAI API support

GPT / Codex with ChatGPT login can use the TLS firewall when its HTTPS traffic is routed through the local proxy. OpenAI SDK apps can use the GPT / OpenAI SDK connection and local OpenAI base URL. Start the proxy, connect the matching client in Firewall, restart the app, and confirm a new entry in Recordings.

MCP tool registration alone does not route prompts. Only supported text requests that reach the proxy are inspected; images, audio, and other unconfigured traffic are outside this coverage.

[note]

Please ensure your AI client's proxy environment variables (HTTP_PROXY, HTTPS_PROXY) are configured to route through the Prompt Firewall's listening port to enable interception.

Explore other tools

→ Secret & Repo Scanner MCP Tool → Dependency Vulnerability Audit Tool → Web Search & Scraper MCP Tool

Frequently asked questions